| From eeef023785dd857cdef367f9283899eb324cb535 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 30 Jul 2020 10:56:49 +0100 |
| Subject: arm64: csum: Fix handling of bad packets |
| |
| From: Robin Murphy <robin.murphy@arm.com> |
| |
| [ Upstream commit 05fb3dbda187bbd9cc1cd0e97e5d6595af570ac6 ] |
| |
| Although iph is expected to point to at least 20 bytes of valid memory, |
| ihl may be bogus, for example on reception of a corrupt packet. If it |
| happens to be less than 5, we really don't want to run away and |
| dereference 16GB worth of memory until it wraps back to exactly zero... |
| |
| Fixes: 0e455d8e80aa ("arm64: Implement optimised IP checksum helpers") |
| Reported-by: guodeqing <geffrey.guo@huawei.com> |
| Signed-off-by: Robin Murphy <robin.murphy@arm.com> |
| Signed-off-by: Will Deacon <will@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| arch/arm64/include/asm/checksum.h | 5 +++-- |
| 1 file changed, 3 insertions(+), 2 deletions(-) |
| |
| diff --git a/arch/arm64/include/asm/checksum.h b/arch/arm64/include/asm/checksum.h |
| index 0b6f5a7d4027c..fd11e0d70e446 100644 |
| --- a/arch/arm64/include/asm/checksum.h |
| +++ b/arch/arm64/include/asm/checksum.h |
| @@ -30,16 +30,17 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl) |
| { |
| __uint128_t tmp; |
| u64 sum; |
| + int n = ihl; /* we want it signed */ |
| |
| tmp = *(const __uint128_t *)iph; |
| iph += 16; |
| - ihl -= 4; |
| + n -= 4; |
| tmp += ((tmp >> 64) | (tmp << 64)); |
| sum = tmp >> 64; |
| do { |
| sum += *(const u32 *)iph; |
| iph += 4; |
| - } while (--ihl); |
| + } while (--n > 0); |
| |
| sum += ((sum >> 32) | (sum << 32)); |
| return csum_fold((__force u32)(sum >> 32)); |
| -- |
| 2.25.1 |
| |